Documentation index

homie

A home server built from one laptop and seven containers, reachable through two deliberately different doors. Four pages describe it; each answers a different question. Start with whichever question you have.

Machine
ThinkPad T470
System
Ubuntu Server 26.04
House address
192.168.1.10
Tailnet address
100.64.0.10
Containers
7
Router ports open
0
01

Which page you want

PageRead it when you are askingWritten for
Operating manual “How do I watch something / sync a file / get in from outside / restart this safely / tell whether it is healthy?” Anyone using the machine
Architecture “What is on this box, and why was it built this way rather than some other way?” Every non-obvious decision, with the reasoning and the cost. Anyone judging or changing the design
Networking “How does a request actually get from my laptop to a file on that disk?” Concepts first, then two hop-by-hop traces. Anyone who wants the mechanism
Wiring diagram “Show me the whole thing at once.” Every component and every connection between them, drawn. Anyone orienting quickly
One fact, one home

These pages deliberately do not repeat each other. The two-door trust model is argued once, in Architecture; how a packet travels is traced once, in Networking; the list of what does not work yet lives once, in the Operating manual. Where a page needs a fact that belongs somewhere else, it links rather than restates.

02

The system in one screen

Seven containers defined by a single docker-compose.yml. Which network interface a service listens on is what decides who can reach it — that is the whole access-control design, and Architecture §02 explains why it is done that way rather than with a firewall.

ServiceJobReachable onBy whom
CaddyReverse proxy, HTTPS front door tailnet :443 :8443 :8444 :8445Me
JellyfinMedia streaming, one login each all :8096Me + roommates
SyncthingKeeps School/Work identical across my devices tailnet :8384 admin · all :22000 syncMe
GluetunHolds the VPN tunnel and owns the namespace qBittorrent lives in tailnet :8080, on qBittorrent’s behalfMe
qBittorrentDownloads, then renames and files what it downloads no network of its ownMe
n8nRuns the school and work automations no published port — Caddy onlyMe
ollamaLocal LLM, CPU only, for those automations no published port — n8n onlyn8n
03

Reading these three ways

In a browser — the full version, with diagrams

Caddy serves this directory on port 8446, bound to 127.0.0.1 only. The single way in is an SSH tunnel, which means no extra network exposure at all — not to the house, not even to the tailnet: 

ssh -L 8446:localhost:8446 homie-lan
# then open http://localhost:8446

In a terminal over SSH — text, no diagrams

bin/homie-docs renders any page as plain text. It strips the SVG diagrams, so the wiring diagram in particular is worth a browser. 

homie-docs                  # list what is here
homie-docs manual           # prefix match
homie-docs --search vpn     # grep every page at once

As files

Everything here is committed to the repo. The two .md files are working notes and read fine in any editor; the four .html pages share homie.css, so open them through the server rather than as file:// if you want them styled.

Keeping these honest

Claims here are checked against the running machine rather than against the plan that produced it — bin/homie-check is the instrument, and it is what these pages were re-verified with. Numbers that drift daily (library size, free space, item counts) are deliberately not quoted anywhere in the set; ask homie-check instead.